Welcome to the new Splunkbase! To return to the old Splunkbase, click here.
CCX Duo Connector Support app icon

CCX Duo Connector Support

About Us: CyberCX is Australia’s greatest force of cyber security. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Duo Connector Support Add-on for "Duo Splunk Connector" looks to provide a single field extraction bundle for Duo logs. This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA available for Duo logs ingested via Duo Splunk Connector API. Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Authentication, Change, and Alert. - The CCX Duo Connector Support Add-on for "Duo Splunk Connector" (https://splunkbase.splunk.com/app/3504/) provides an additional sourcetype for selection ("duo") which replaces the use of default json by Splunk. *Please under "More settings" on "Duo Splunk Connector" setup select Set sourcetype to "duo" and proceed.

splunk product badge

Compatibility
Not Available
Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0
CIM Version: 5.x
Rating

0

(0)

Log in to rate this app
About Us: CyberCX is Australia’s greatest force of cyber security. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Duo Connector Support Add-on for "Duo Splunk Connector" looks to provide a single field extraction bundle for Duo logs. This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA available for Duo logs ingested via Duo Splunk Connector API. Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Authentication, Change, and Alert. - The CCX Duo Connector Support Add-on for "Duo Splunk Connector" (https://splunkbase.splunk.com/app/3504/) provides an additional sourcetype for selection ("duo") which replaces the use of default json by Splunk. *Please under "More settings" on "Duo Splunk Connector" setup select Set sourcetype to "duo" and proceed.

Categories

Created By

Henrique Linsmeyer

Type

addon

Downloads

415

Resources

Login to report this app listing